CVE Catalog
CVE-2026-65673
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk0.80%
54th percentile - higher than 54% of all known CVEs
Summary
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized user can elevate privileges locally, potentially leading to full system compromise.
Recommendation
Apply patches provided by Microsoft for Microsoft Entra Connect Sync.
Original NVD description (English source)
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges locally.